mirror of
https://github.com/0rangebananaspy/authelia.git
synced 2024-09-14 22:47:21 +07:00
42581dfe93
In order to redirect the user after authentication, Authelia uses rd query parameter provided by the proxy. However an attacker could use phishing to make the user be redirected to a bad domain. In order to avoid the user to be redirected to a bad location, Authelia now verifies the redirection URL is under the protected domain.
32 lines
1.3 KiB
TypeScript
32 lines
1.3 KiB
TypeScript
import { DomainExtractor } from "./DomainExtractor";
|
|
import Assert = require("assert");
|
|
|
|
describe.only("shared/DomainExtractor", function () {
|
|
describe("test fromUrl", function () {
|
|
it("should return domain from https url", function () {
|
|
const domain = DomainExtractor.fromUrl("https://www.example.com/test/abc");
|
|
Assert.equal(domain, "www.example.com");
|
|
});
|
|
|
|
it("should return domain from http url", function () {
|
|
const domain = DomainExtractor.fromUrl("http://www.example.com/test/abc");
|
|
Assert.equal(domain, "www.example.com");
|
|
});
|
|
|
|
it("should return domain when url contains port", function () {
|
|
const domain = DomainExtractor.fromUrl("https://www.example.com:8080/test/abc");
|
|
Assert.equal(domain, "www.example.com");
|
|
});
|
|
|
|
it("should return domain when url contains redirect param", function () {
|
|
const domain0 = DomainExtractor.fromUrl("https://www.example.com:8080/test/abc?rd=https://cool.test.com");
|
|
Assert.equal(domain0, "www.example.com");
|
|
|
|
const domain1 = DomainExtractor.fromUrl("https://login.example.com:8080/?rd=https://public.example.com:8080/");
|
|
Assert.equal(domain1, "login.example.com");
|
|
|
|
const domain2 = DomainExtractor.fromUrl("https://single_factor.example.com:8080/secret.html");
|
|
Assert.equal(domain2, "single_factor.example.com");
|
|
});
|
|
});
|
|
}); |